- Freeradius-Users - lists.freeradius.org

Login incorrect (Home Server says so)... - But why?
by uni＠christiankraus.de 06 Aug '08

06 Aug '08

Dear group, you obviously still know my old thread: http://lists.freeradius.org/mailman/htdig/freeradius-users/2008-July/msg000… I am using still freeradius 1.1.7 Well, the problem was not the foreign server which had the problems. It is kind of embarrassing to say: The reason was my access points. There was a setting, saying that each password should be transfered while being coded with md5. Although I don´t know why this had any influence on the clients with MSChapv2/PEAP or TTLS/PAP I removed the setting and voila it works. So now, foreigner from other wanted enterprises can use our WLAN using their login credentials. So, the other way should also work. Do you know eduroam? The service we use is similar to this Let´s look at my setup: WLAN-accesspoints with SSID1 for local users-------------------------------------------------------------------------->Windows 2003 with IAS and active directory same WLAN-accesspoints with SSID2 for foreign users---------------->myFreeRadiusServer------------->Windows 2003 with IAS and active directory outside central server<------------------------------------------------------------->myFreeRadiusServer------------->Windows 2003 with IAS and active directory outside central server<------------------------------------------------------------->someonesOtherRadiusServer1 outside central server<------------------------------------------------------------->someonesOtherRadiusServer2 ... So, my local users are able tu use SSID1 with 802.1X. They use PEAP with MSCHAPv2 to use the WLAN. No problem. It works. Also, if they accidently use SSID2, which is for foreigners, they can use it. They login with "username(a)mydomain.com". Everything which ends with "@mydomain.de" is proxied from "myFreeRadiusServer" to the "Windows 2003 with IAS and active directory". This is also working without any problems. Foreigners can use their credentials, e.g.: "username(a)someonesOtherdomain.com". This credentials are passed to "myFreeRadiusServer". Everything else, that doesn´t end "@mydomain.de" is passed to the "outside central server". There is a list which maps the other "@someonesOtherdomain.com" to the right "someonesOtherRadiusServers" So dozen of other servers. And from there the request is proxied to the corresponding "someonesOtherRadiusServer" which belongs to the right "@someonesOtherdomain.com" What is working: I can use the "username(a)someonesOtherdomain.com" from a foreign enterprise to login and use the WLAN. No problem here. But the other way round doesn´t work. I asked a collegue from one of those foreign enterprises to test the login with "username(a)mydomain.com" He gave me the following error message: Mon Aug 4 17:19:57 2008 : Auth: Login incorrect (Home Server says so): [username(a)mydomain.com] (from client CB-Access-Point-802.11 port 2 cli 00-1B-77-A4-7B-A2) I don´t know where the problem is. Perhaps you can give me a hint? Coming to my configuration files with changed IP addresses...: ----------------------------------------------------------------------------- clients.conf: client WLAN-IP-AP1 { secret = oft36fW! shortname = WLAN-AP1 nastype = other } ... client "outside central server"-IP { secret = ASECRETPASSWORD shortname = top-level-radius1 nastype = other } client "outside central backup server"-IP { secret = ASECRETPASSWORD shortname = top-level-radius1 nastype = other } ----------------------------------------------------------------------------- proxy.conf realm mydomain.com { type = radius authhost = IAS-IP:1812 accthost = IAS-IP:1813 secret = anotherpass #ldflag = round_robin1 nostrip } realm DEFAULT { type = radius authhost = outside central server:1812 accthost = outside central server:1813 secret = pass nostrip } realm DEFAULT { type = radius authhost = outside central backup server:1812 accthost = outside central backup server:1813 secret = pass nostrip } ----------------------------------------------------------------------------- users DEFAULT, Realm == mydomain.com, FreeRADIUS-Proxied-To == IAS-IP User-Name = `%{User-Name}`, Fall-Through = yes, Auth-Type := EAP DEFAULT, User-Name =~ "^[Aa][Nn][Oo][Nn][Yy][Mm][Oo][Uu][Ss]@.*$" Auth-Type := EAP DEFAULT, User-Name =~ "$@$" Auth-Type := EAP DEFAULT Realm == NULL Auth-Type := Reject ----------------------------------------------------------------------------- ----------------------------------------------------------------------------- eap.conf Although it is not doing anything as I learned eap { timer_expire = 60 ignore_unknown_eap_types = yes cisco_accounting_username_bug = no md5 { } leap { } tls { private_key_password = pass private_key_file = /usr/src/freeradius/key.pem #${raddbdir}/certs/cert-srv.pem certificate_file = /usr/src/freeradius/freeradius-cert.pem CA_file = /usr/src/freeradius/chain.txt dh_file = ${raddbdir}/certs/dh random_file = ${raddbdir}/certs/random fragment_size = 1024 include_length = yes } ttls { default_eap_type = mschapv2 copy_request_to_tunnel = no use_tunneled_reply = yes } peap { default_eap_type = mschapv2 copy_request_to_tunnel = no use_tunneled_reply = yes } mschapv2 { } } ----------------------------------------------------------------------------- radiusd.conf, where I hardly changed anything. I commentec many things out... prefix = /usr exec_prefix = ${prefix} sysconfdir = /etc localstatedir = /var sbindir = ${exec_prefix}/sbin logdir = ${localstatedir}/log/radius raddbdir = ${sysconfdir}/raddb radacctdir = ${logdir}/radacct confdir = ${raddbdir} run_dir = ${localstatedir}/run/radiusd log_file = /var/log/radius/radius.log log_destination = files libdir = /usr/lib/freeradius pidfile = ${run_dir}/radiusd.pid max_request_time = 30 delete_blocked_requests = no cleanup_delay = 5 max_requests = 1024 bind_address = * port = 0 hostname_lookups = no allow_core_dumps = no regular_expressions = yes extended_expressions = yes log_stripped_names = yes log_auth = yes log_auth_badpass = yes log_auth_goodpass = yes usercollide = no lower_user = no lower_pass = no nospace_user = no nospace_pass = no checkrad = ${sbindir}/checkrad security { max_attributes = 200 reject_delay = 1 status_server = no } proxy_requests = yes $INCLUDE ${confdir}/proxy.conf $INCLUDE ${confdir}/clients.conf snmp = no $INCLUDE ${confdir}/snmp.conf thread pool { start_servers = 5 max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 } modules { pap { auto_header = yes } chap { authtype = CHAP } pam { pam_auth = radiusd } unix { cache = no cache_reload = 600 radwtmp = ${logdir}/radwtmp } $INCLUDE ${confdir}/eap.conf mschap { use_mppe = yes require_encryption = yes require_strong = yes with_ntdomain_hack = no } realm IPASS { format = prefix delimiter = "/" ignore_default = no ignore_null = no } realm suffix { format = suffix delimiter = "@" ignore_default = no ignore_null = no } realm realmpercent { format = suffix delimiter = "%" ignore_default = no ignore_null = no } realm ntdomain { format = prefix delimiter = "\\" ignore_default = no ignore_null = no } checkval { item-name = Calling-Station-Id check-name = Calling-Station-Id data-type = string } preprocess { huntgroups = ${confdir}/huntgroups hints = ${confdir}/hints with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no } files { usersfile = ${confdir}/users acctusersfile = ${confdir}/acct_users preproxy_usersfile = ${confdir}/preproxy_users compat = no } detail { detailfile = ${radacctdir}/%{Client-IP-Address}/detail-%Y%m%d detailperm = 0600 } acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } $INCLUDE ${confdir}/sql.conf radutmp { filename = ${logdir}/radutmp username = %{User-Name} case_sensitive = yes check_with_nas = yes perm = 0600 callerid = "yes" } radutmp sradutmp { filename = ${logdir}/sradutmp perm = 0644 callerid = "no" } attr_filter { attrsfile = ${confdir}/attrs } counter daily { filename = ${raddbdir}/db.daily key = User-Name count-attribute = Acct-Session-Time reset = daily counter-name = Daily-Session-Time check-name = Max-Daily-Session allowed-servicetype = Framed-User cache-size = 5000 } sqlcounter dailycounter { counter-name = Daily-Session-Time check-name = Max-Daily-Session reply-name = Session-Timeout sqlmod-inst = sql key = User-Name reset = daily query = "SELECT SUM(AcctSessionTime - \ GREATEST((%b - UNIX_TIMESTAMP(AcctStartTime)), 0)) \ FROM radacct WHERE UserName='%{%k}' AND \ UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%b'" } sqlcounter monthlycounter { counter-name = Monthly-Session-Time check-name = Max-Monthly-Session reply-name = Session-Timeout sqlmod-inst = sql key = User-Name reset = monthly # This query properly handles calls that span from the # previous reset period into the current period but # involves more work for the SQL server than those # below # The same notes above about the differences between mysql # versus postgres queries apply here. query = "SELECT SUM(AcctSessionTime - \ GREATEST((%b - UNIX_TIMESTAMP(AcctStartTime)), 0)) \ FROM radacct WHERE UserName='%{%k}' AND \ UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%b'" } always fail { rcode = fail } always reject { rcode = reject } always ok { rcode = ok simulcount = 0 mpp = no } expr { } digest { } exec { wait = yes input_pairs = request } exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = request output_pairs = reply } instantiate { exec expr } authorize { preprocess attr_filter chap mschap suffix eap files pap } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } unix eap } preacct { preprocess acct_unique suffix files } accounting { detail unix radutmp } session { radutmp } post-auth { } pre-proxy { } post-proxy { eap }

2 1

How to set accounting with inner-tunnel Virtual server
by Andy An 06 Aug '08

06 Aug '08

Hi Alan/Ivan: Thanks for your great work of helps/guides that makes us progress step by step. Now my question is how I can set accounting work within inner-tunnel as I need to use eap-ttls/pap to autho/authen users via wireless AP. In fact I read this message: " There are no accounting requests inside of EAP-TTLS or PEAP tunnels." but My project needs me to have an accounting records and should keep them for a while. I use freeradius2.0.5 with mysql as the accounting backend. Thanks. -- Andy An Junior Programmer Information Technology Services Emily Carr University of Art and Design Tel: 604-630-4556 Fax: 604-844-3801 SB Room 341

2 1

Radius server request from new server.
by User for Free Radius mail list 06 Aug '08

06 Aug '08

Hello, We are trying to figure out how to do an auth from one client but not from another. Let me explain: For our DSL clients we use a separate radius server and backup server. For everything else (dialup, news) we use "other" servers. Our problem comes in that we set all DSL clients on these "other" servers to Auth-Type := Reject for each DSL customer, unless they subscribe to discounted dialup service as well. The problem is if the DSL client wants to use the news servers, the "other" radius servers will not auth the client for news. Question?? How can we direct the authentication for a news server but not the dialup servers without using separate radius servers. Did that make any sense? Thanks, Ken

1 0

question
by Martin Silvero 05 Aug '08

05 Aug '08

regarding this settlement, and delete certificates and regenerate, but remains the same mistake: Tue Aug 5 15:01:28 2008 : Error: rlm_eap: SSL error error:06065064:digital envelope routines:EVP_DecryptFinal_ex:bad decrypt Tue Aug 5 15:01:28 2008 : Error: rlm_eap_tls: Error reading private key file /usr/local/etc/raddb/certs/server.pem Tue Aug 5 15:01:28 2008 : Error: rlm_eap: Failed to initialize type tls Tue Aug 5 15:01:28 2008 : Error: /usr/local/etc/raddb/eap.conf[17]: Instantiation failed for module "eap" Tue Aug 5 15:01:28 2008 : Error: /usr/local/etc/raddb/sites-enabled/inner-tunnel[223]: Failed to find module "eap". Tue Aug 5 15:01:28 2008 : Error: /usr/local/etc/raddb/sites-enabled/inner-tunnel[176]: Errors parsing authenticate section. Tue Aug 5 15:01:28 2008 : Debug: } Tue Aug 5 15:01:28 2008 : Debug: } Tue Aug 5 15:01:28 2008 : Error: Errors initializing modules it seems to me like a certificate`s password problem. take a look at server.cnf ca.cnf and clients.cnf. or read the document that came with the package how to remove all certificates and create the 3some ( :) ) of them. 2008/8/5 Martin Silvero <silvero.martin(a)gmail.com>: > > Hello my name is martin and I'm from Argentina. > > I'm trying to configure for use with FreeRADIUS eap + tls and ldap, but > recently started doing this and I am wrong in the first configurations, what > I did was set a cleinte which is a AP's and when I run radiusd-X -x strip me > this mistake even if the PATH're ok. Can someone could give me a hand > please? > > > > Tue Aug 5 11:00:31 2008 : Error: rlm_eap: SSL error error:06065064:digital > envelope routines:EVP_DecryptFinal_ex:bad decrypt > Tue Aug 5 11:00:31 2008 : Error: rlm_eap_tls: Error reading private key > file /usr/local/etc/raddb/certs/ > server.pem > Tue Aug 5 11:00:31 2008 : Error: rlm_eap: Failed to initialize type tls > Tue Aug 5 11:00:31 2008 : Error: /usr/local/etc/raddb/eap.conf[17]: > Instantiation failed for module "eap" > Tue Aug 5 11:00:31 2008 : Error: > /usr/local/etc/raddb/sites-enabled/inner-tunnel[223]: Failed to find module > "eap". > Tue Aug 5 11:00:31 2008 : Error: > /usr/local/etc/raddb/sites-enabled/inner-tunnel[176]: Errors parsing > authenticate section. > Tue Aug 5 11:00:31 2008 : Debug: } > Tue Aug 5 11:00:31 2008 : Debug: } > Tue Aug 5 11:00:31 2008 : Error: Errors initializing modules > > > > thanks!!!!! -- -- Silvero Martin

1 0

Server not responding to requests
by Yoho, Cindy 05 Aug '08

05 Aug '08

Hi All, I have freeradius 1.1.7 running on RHEL 5. radtest works with a local user setup, and also with authentication via Active Directory. However, anything outside the radius server host does not get a reply. I have configured a Multitech MA820 and also tried ntradping, and both get the same results - "Could not receive a response from server" is the message when I use ntradping, and "Server did not respond in a timely manner" is the response when I try to connect from the Multitech. Is there some setting I need to check to make sure external access is enabled? Thanks in advance ~ Cindy Yoho Systems Engineer United Methodist Publishing House Nashville, TN

4 3

Problems with FREERADIUS configurations
by Martin Silvero 05 Aug '08

05 Aug '08

Hello im from Argentina and im configure freeradius with eap+tls but give me one error: Tue Aug 5 13:11:37 2008 : Error: rlm_eap: SSL error error:06065064:digital envelope routines:EVP_DecryptFinal_ex:bad decrypt Tue Aug 5 13:11:37 2008 : Error: rlm_eap_tls: Error reading private key file /usr/local/etc/raddb/certs/server.pem Tue Aug 5 13:11:37 2008 : Error: rlm_eap: Failed to initialize type tls Tue Aug 5 13:11:37 2008 : Error: /usr/local/etc/raddb/eap.conf[17]: Instantiation failed for module "eap" Tue Aug 5 13:11:37 2008 : Error: /usr/local/etc/raddb/sites-enabled/inner-tunnel[223]: Failed to find module "eap". Tue Aug 5 13:11:37 2008 : Error: /usr/local/etc/raddb/sites-enabled/inner-tunnel[176]: Errors parsing authenticate section. Tue Aug 5 13:11:37 2008 : Debug: } Tue Aug 5 13:11:37 2008 : Debug: } Tue Aug 5 13:11:37 2008 : Error: Errors initializing modules im need help please!! many thanks!!! -- -- Silvero Martin

1 0

Re: question
by Martin Silvero 05 Aug '08

05 Aug '08

Hello my name is martin and I'm from Argentina. I'm trying to configure for use with FreeRADIUS eap + tls and ldap, but recently started doing this and I am wrong in the first configurations, what I did was set a cleinte which is a AP's and when I run radiusd-X -x strip me this mistake even if the PATH're ok. Can someone could give me a hand please? Tue Aug 5 11:00:31 2008 : Error: rlm_eap: SSL error error:06065064:digital envelope routines:EVP_DecryptFinal_ex:bad decrypt Tue Aug 5 11:00:31 2008 : Error: rlm_eap_tls: Error reading private key file /usr/local/etc/raddb/certs/server.pem Tue Aug 5 11:00:31 2008 : Error: rlm_eap: Failed to initialize type tls Tue Aug 5 11:00:31 2008 : Error: /usr/local/etc/raddb/eap.conf[17]: Instantiation failed for module "eap" Tue Aug 5 11:00:31 2008 : Error: /usr/local/etc/raddb/sites-enabled/inner-tunnel[223]: Failed to find module "eap". Tue Aug 5 11:00:31 2008 : Error: /usr/local/etc/raddb/sites-enabled/inner-tunnel[176]: Errors parsing authenticate section. Tue Aug 5 11:00:31 2008 : Debug: } Tue Aug 5 11:00:31 2008 : Debug: } Tue Aug 5 11:00:31 2008 : Error: Errors initializing modules thanks!!!!!

2 1

How to link radiusd statically?
by abhay＠clearcrypt.com 05 Aug '08

05 Aug '08

Hi, I would like to build radiusd with all necessary libraries statically linked in. I have tried the following command ./configure --enable-shared=no --enable-static=yes During linking phase, there are a bunch of problems; 1. libperl.a is not found (that has been fixed by downloading Perl 5.8.8 and building it locally); 2. many undefined functions, mainly in libkrb5.a Is this a way to go? Has anyone successfully built freeradius 2.0.5 with static linkage? Thanks! Abhay

4 3

Re: Seek through several RADIUS severs without realms
by Alan DeKok 05 Aug '08

05 Aug '08

Ronen Kfir wrote: > I would like to use FreeRADIUS as proxy to IAS servers. The question now > is how do I create those FreeRADIUS groups and how do I manage the > groups membership within FreeRADIUS. Read "man rlm_passwd"? This is documented. Alan DeKok.

1 0

rlm_ippool.so missing ?
by Xiaochen Jing 05 Aug '08

05 Aug '08

Hello all, When I was trying to run Freeradius, I got the following errors. It says no "rlm_ippool.so" exists. I took a look into /usr/local/lib, and there is no such file. Could someone help me on this? Thanks so much. I need to let Freeradius assign dynamic IP address from IP_Pool to PPPoE clients. Here is the error message: /usr/local/etc/raddb/radiusd.conf[1739]: Failed to link to module 'rlm_ippool': rlm_ippool.so: cannot open shared object file: No such file or directory /usr/local/etc/raddb/sites-enabled/default[354]: Failed to find module "main_pool". /usr/local/etc/raddb/sites-enabled/default[352]: Errors parsing post-auth section.

2 2